What to do when OKX reports a suspicious login: device, email and security review order

A suspicious login alert does not always mean compromise, but it should trigger a fast review of device history, email safety, password and 2FA status.

Who this guide is for

• Useful when you see a new device, strange IP or unusual login alert
• First verify whether the action was yours before escalating
• Email access and 2FA status matter as much as the OKX password

Suggested path

1. First compare the alert time, device, location and IP with your own recent login behavior or network changes.
2. If you cannot explain it clearly, secure your email, change password and review 2FA, active devices and API permissions immediately.
3. If OKX triggers a new-device or security verification, complete it only through the official flow rather than through random links.
4. If you also see unknown orders, changed settings or loss of control, move into recovery mode and collect the key timeline.

Key checks

• suspicious login
• device check
• security review

FAQ

Does a suspicious login alert always mean the account was hacked?

Not always. Device changes, VPNs or region shifts can also trigger alerts.

Should I change my password first or check email first?

If the source is unclear, secure both email and account-entry points quickly.

When do I need full account recovery?

When you cannot explain the login or already see unauthorized activity or changed permissions.

Next move

Once you enter OKX, use the live platform page as the final source for fees, eligibility and campaign rules.